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are  interested  in  the  problem  of  minimizing  the 
expected  cost  of  testing  a coherent  system.  The 
concept  of  the  Importance  of  Components  is  used  to 
develop  a branch  and  bound  algorithm  which  deter- 
mines the  optimal  testing  policy  for  any  coherent 
system. 
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OPTIMAL  TESTING  PROCEDURES  FOR  COHERENT  SYSTEMS 

by 

Yosi  Ben-Dov 

1.  INTRODUCTION 

We  are  interested  in  the  problem  of  minimizing  the  expected  cost  of 
testing  a coherent  system.  Our  system  is  composed  of  n components  that 
either  work  or  fail,  and  its  structure  function  is  monotonically  increasing 
in  each  argument.  By  "testing"  a system,  we  mean  determining  its  state 
which  can  either  be  "functioning"  or  "failed."  We  do  the  actual  testing  by 
checking  the  components  of  the  system  in  an  optimal  sequence.  Components 
can  be  individually  tested  and  tests  give  perfect  information.  Associated 

with  each  component  is  a cost  for  testing  it  (c^  , i * 1,2 n)  and  a 

priori  probability  that  it  is  functioning  (p^  , i * 1,2,  ...,  n)  . (The  a 
priori  probability  that  a component  is  failed  is  given  by  q^  * 1 - , 

i * 1,2,  ...,  n .)  Components  are  assumed  to  function  or  fail  independently 
of  each  other.  The  problem  is,  therefore,  to  find  the  optimal  testing 
policy  (which  can  be  represented  as  a decision  tree) . 

R.  Butterworth  [3]  solved  this  problem  for  the  special  cases  of  series 
and  parallel  systems,  and  gave  a sufficient  condition  for  the  optimality  of 
his  procedure  for  k-out-of-n  systems.  (Such  a system  works  if  and  only  if 
at  least  k of  its  n components  work.)  J.  Halpem  [4]  presented  an 
optimal  sequential  procedure  for  the  k-out-of-n  system  with  equal  testing 
costs  for  all  components.  H.  Lambert  [5]  dealt  with  the  problem  of  mini- 
mizing the  expected  time  of  testing  a failed  system.  He  suggested  a 
criteria  for  solving  the  problem  for  general  systems,  and  showed  how  to  use 
it  specifically  for  the  cases  of  series  and  parallel  systems. 
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In  Section  2,  we  define  the  concept  of  Importance  of  Components  which 
is  used  as  the  decision  criterion  for  a Branch  and  Bound  algorithm.  This 
algorithm  is  based  on  a paper  by  Little  et  al.  [6],  who  presented  a branch 
and  bound  algorithm  for  the  Travelling  Salesman  problem,  and  on  the  paper 
by  Reinwald  and  Soland  [7].  In  Section  3,  we  explain  the  rationale  of  our 
algorithm,  and  prove  its  optimality.  Finally,  in  Section  4,  we  describe 
the  algorithm  itself,  and  give  an  example  of  its  operation. 
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. RELIABILITY  IMPORTANCE  OF  COMPONENTS 

The  measure  of  Reliability  Importance  takes  into  account  the  structur- 
al importance  of  the  components  as  well  as  their  failure  probabilities. 

This  measure  tells  us  how  much  we  can  improve  the  system  reliability  by  im- 
proving the  reliability  of  any  single  component.  Specifically,  we  shall 
use  Birnbaum's  definition  of  importance  [2], 


Definition: 


The  Reliability  Importance 


of  component  j 


is  given  by: 


(2.1) 


3h(P) 

Ij  " 


where  h(P)  is  the  reliability  function  of  the  system,  and  jP  is  the 
vector  of  probabilities:  £=  (p^,  ...,  p j , pn)  . 

Using  the  well  known  identity  which  holds  for  the  reliability  function: 

h(P)  * pih(l1,P)  + q^MO^P)  for  i = 1 n , we  can  get  a definition 

equivalent  to  (2.1): 

(2.2)  Ij  - h(lj,P)  - h (Oj  , P) 


or  more  explicitly: 


(2.3)  Ij  - E[<Klj,X)  - d>  (Oj  ,X)  ] - P{  [<J>  (lj  ,X)  - <(>(0j,X)]  - 1} 


where 


x 


i 


when  the  it'1  component  is  failed 
when  the  ith  component  is  functioning 


i 
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and  <{>(X)  is  the  structure  function  of  the  system  which  satisfies: 


$(X) 


!0  when  the  system  is  failed 
1 when  the  system  is  functioning. 


Remark: 


If  ■ h for  every  i 


then: 


3h(P) 


P-te,. 


• ,h) 


which  gives 


us  Birnbaum's  definition  of  Structural  Importance  of  the  components,  i.e.: 
I*(J)  ‘ITT  l - 4>  (0.  ,X)  ] . Note  that 

* 2n  1 {x|Xj=l}  J J “ 

£ [ <J>  (1 . ,X)  - <f>(0 . ,X)]  is  the  total  number  of  state  vectors  in  which 

{X|Xj«l}  j j 

component  j is  critical  to  the  system,  in  the  sense  that  for  those  vectors 
the  system  will  be  functioning  if  and  only  if  component  j will  be  func- 
tioning. 


Eatamples: 

For  the  following  eXamples,  assume  that  the  components  of  the  system 
he’^a  been  labeled  such  that  their  probabilities  are  ordered  as: 


- P2  - 


1 Pr 


1.  Series  System: 


The  reliability  function  of  a series  system  is  given  by: 
n 

h(P)  * II  p and  thus:  I m II  p . Therefore:  I-  >_  I-  >...>_  I , 
i-1  1 J ii*j  1 1 1 n 

i.e.,  the  least  reliable  component  is  the  most  important  in  the  system.  A 

series  system  is  functioning  if  and  only  if  all  of  its  components  are 

functioning,  so  that  the  failure  of  any  component  causes  a system  failure 
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and  the  system  is  no  better  than  its  weakest  component.  Hence,  the  weakest 
component  in  the  system  is  the  most  important  component. 

2.  Parallel  System: 

n 

h(P)  = 1 - E (1  - p. ) thus:  I = E (1  - p ) . Therefore: 
i-1  1 3 i*j  1 

1]^  i ^2  - "*  - In  * i*e*»  most  reliable  component  is  the  most  important 
in  the  system.  This,  again,  is  very  intuitive,  since  a parallel  system 
functions  if  at  least  one  of  its  components  functions.  Hence,  the  strong- 
est component  in  the  system  is  the  most  important. 

3.  2-out-of-3  System: 

The  reliability  function  of  a 2-out-of-3  system  is  given  by: 
h(P)  «*  PXP2  + PjP-j  + P2P3  - 2P1P2P3  » and  thus; 

h * p2  + p3  " 2p2p3 
l2  “ P1  + p3  ' 2plp3 
X3  " P1  + p2  “ 2pip2  * 

If  P^  ■ H for  i - 1 , 2 , 3 , then:  1^  • I2  ■ 1^  , since  all  the 

components  are  equally  important  as  far  as  the  structure  of  the  system  is 
concerned. 

If  p^  <_  h for  1 * 1 , 2 , 3 , then:  1^  >_  I2  >_  , i.e.,  the 

weakest  component  is  the  most  important  for  the  system. 

If  p^  >_  H for  i ■ 1 , 2 , 3 , then:  1^  <_  I2  I3  » i.e.,  the  most 

important  component  is  the  one  with  the  highest  reliability. 
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t 

5 


J 


*< 


I 


A 
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Otherwise,  ^ max  , i.e.,  the  most  important  component  is 

the  or.e  whose  probability  of  working  is  neither  the  highest  nor  the  small- 
est among  the  three  components. 
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3. THE  REASONING  BEHIND  THE  ALGORITHM 


Let  us  first  define  a measure  of  "unimportance"  of  component  j 


(3.1) 


' 1 - 


and  investigate  its  meaning.  Suppose  we  are  given  two  state  vectors:  XJ 
2 

and  X such  that : 


(i)  MX1)  = MX2)  and 

(ii)  x2  = x2  for  every  i ^ iQ  , but  x2  ^ x2 

~ n 


1 2 

We  want  to  find  the  value  of  MX  ) (or,  d>  (_X  ) ) , and  to  do  so  by  testing 

the  individual  components.  One  way  of  doing  this  would  be  to  test  all  the 

components  in  an  arbitrary  order  and  thus  find  the  value  of  MX2)  . This 

would  definitely  be  unnecessarily  costly,  since  the  value  of  MX2)  is 

independent  of  the  value  of  x^  , and  we  therefore  need  not  check  this 

o 

component . 

The  measure  of  unimportance  which  we  defined  can  be  described  as 
follows:  we  find  the  total  number  of  vectors  for  which  the  checking  of  a 
specific  component  is  unnecessary,  and  then  look  at  the  probability  of  the 
occurrence  of  those  vectors,  i.e.:  Prob  {j  is  unimportant)  ■ I ■ 

i - ij  - PUMij.Jp  - Mo  ,x)]  - o)  . 

Next  we  define: 


(3.2) 


d = c I 

i J j 


which  is  a measure  of  the  expected  extra  cost  due  to  testing  component  j 
even  though  it  is  unnecessary  to  know  its  state.  Thus:  e^  - c^ 1^  is  a 


measure  of  the  expected  necessary  expense  due  to  testing  component  j . 
This  is  equal  to  the  cost  of  testing  component  j minus  the  expected  cost 
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of  the  extra  expense,  i.e.,  e..  = c^I^.  - c^  - d^  . We  define  the  total 

expected  necessary  expense  to  be: 


(3.3)  I •l  cklfc  = l c (1  - " l ck  * l ck\  “ l ck  ~ l dk 

k k k k k k 


Finally,  we  introduce  some  additional  notation: 


(3.4) 


Ij(i)  - h(lj,li,P)  - h(0  .l^P) 


(3.5) 


IjU')  = h(lj,01,P)  - h(0j,0i,P) 


where  1^ (i)  and  Ij(i')  are  the  measures  of  the  importance  of  component 
j when  component  i is  given  to  be  functioning  or  failed  respectively. 
Also,  let: 


(3.6) 


and 


(3.7) 


v^-'jVd 


Vl'>  - Vi'1')  • 


In  general,  we  define: 


(3.8) 


^<2,8)  - h(lj  ,Z,lg,P)  - h(0jf2,la,P) 


(3.9)  Ijd.s’)  - h(lJ,Z,Os,P)  - h(0j,Z,0s,P) 


where  Ij(Z^,s)  and  Ij(Z,s')  are  the  measures  of  the  importance  of  com- 
ponent J , given  the  vector  of  known  component  states  Z , and  component 


Ai 
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s is  given  to  be  functioning  or  failed  respectively.  Also,  let: 

(3.10)  djCZ.s)  - CjI^Z.s) 
and 

(3.11)  d j (Z , s ' ) - CjI^Z.s')  . 

Following  the  above  discussion,  one  can  suggest  the  following  algorithm: 

start  the  testing  procedure  by  checking  component  i , which  minimizes  d^ 

for  k ■ 1,2,  ...,  n . Then  continue  to  develop  the  testing  tree  by  choosing 

the  components  that  minimize  d^  (i)  and  (±  * > for  k , j - 1,2,  ...,  n ; 

k , j 4 i , and  continue  in  this  manner.  This  method,  however,  does  not 

necessarily  give  an  optimal  testing  procedure.  Actually,  we  can  show  by 

induction  (see  Theorem  1)  that  1 + d^  is  a lower  bound  for  the  expected 

cost  of  all  testing  procedures  which  start  by  testing  component  i . As  a 

corollary,  it  is  easy  to  see  that  I + min  {d  } is  the  minimum  expected 

i 1 

cost  of  all  testing  procedures.  Therefore,  we  must  modify  the  "naive" 
algorithm  suggested  above  in  order  to  be  able  to  consider  testing  procedures 
which  have  a higher  lower  bound,  but  yet  may  give  a smaller  expected  cost. 

Before  we  prove  Theorem  1,  we  present  a lemma  which  states  that  testing 
component  i first  does  not  change  the  expected  extra  cost  of  testing  any 
of  the  other  components. 

Lemma: 

< 


l dk  - Pi  l MO  + q<  l Mi’) 

ki*i  K 1 k K 1 k K 


1 
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Proof : 

(3.12)  l d « l cl  - l c (1  - [h(l  ,P)  - h(0  ,P)]}  . 

k*i  k*i  k*i 


l d.(i)  - l cl  (i)  - J ck(l  - [h(lk,li,P)  - h(0k,l  ,P)]} 
k k?i  kj*i 

l d <i*)  - l ckIk(l')  - l ck(l  - [h(lk,01,P)  - hCO^Oj,!)]} 
k k?i  k?*i 

»i  i dk(i> + ii  l v1’*  - „L  ck  - _L  ck<»ilh(ii-ii-2>  - 

k k kfi  kfi 

+ q1[h(lk,01,P)  - h(0k,0i,P)]} 


(3.13) 


l c - l c {[p  h(l  ,1.,P)  + q.hd.,0  ,P)] 
kid  k kid  k 1 Y 1 1 k 1 

- [pih(Ok,l1.P)  + qih(0k,0i,P)]} 


but,  recalling  that: 


h(P)  - pih(l1,P)  + qih(0lfP) 


we  also  have: 


h(lk,P)  - pih(lk,li,P)  - qih(lk,0i,P) 


and: 


h(0k,P)  - P1h(0k,l1,P)  - q1h(0k,0i,P) 


.*.  (3.13)  - ck  - ck(h(lk,P)  - h(0k,P)] 

- ckU  - [h(lk,P)  - h(0k,P)]>  - (3. 12) . ■ 
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Theorem  1: 

A lower  bound  for  the  expected  cost  of  all  testing  procedures  which 
start  by  testing  component  i , is : I + d^  . 

Proof; 

We  use  an  induction  proof,  where  the  induction  is  based  on  n , the 
number  of  components  in  the  system. 

For  n * 1 , the  proof  is  trivial.  For  n = 2 , there  are  two 
possible  systems  with  two  components:  a series  system  and  a parallel 
system.  We  study  them  in  turn. 

1.  Series  System: 

h(P)  - pxp2 

* cx(l  - 1^)  - Cjtl  - [h(l1,p2)  - h(01,p2)]}  - c^l  - p2  + 0)  - cLq2 

d2  - c2(l  - I2)  - c2U  - [h(Pl,l2)  - h(Pl,02)]}  - c2(l  - Px  + 0)  - c^ 

2 2 

1 " I ci  - J di  " C1  + c2  ‘ clq2  ‘ c2ql  “ C1P2  + C2P1  • 

Finally: 

1 + dl  - clP2  + c2Pl  + Clq2  - cx  + Plc2 

1 + d2  - C;ip2  + c2px  + c2qx  - c2  + . 

Those  lower  bounds  are  actually  equal  to  the  expected  cost  of  testing 
the  system,  when  we  start  by  checking  component  1 or  2 respectively. 
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2.  Parallel  System: 

h(P)  “ P1P2  * P]P2 

dL  - <^(1  - 1^)  = CjU  - [h(l1,p2>  - h(01,p2)]}  = Cl(l  - 1 + p2)  - CjP2 

d2  - c2(l  - I2)  - c2(l  - [hCp^lj)  " h(p1,02)]}  = c2(l  - 1 + p1)  - c2p2 

2 2 

I=  l ci  - l di  “ C1  + C2  " clp2  ‘ c2pl  " clq2  + c2ql  * 
i*l  i=l 

Therefore: 

1 + dl  “ clq2  + c2ql  + Clp2  “ C1  + qlc2 

I + d2  - c^2  + + c2Pl  - c2  + q^  . 

Here,  again,  the  lower  bounds  are  equal  to  the  expected  costs. 

Now  we  assume  that  the  theorem  is  true  for  systems  with  (n  - 1)  com- 
ponents, and  show  it  is  true  for  systems  with  n components.  Assume  that 
the  first  component  to  be  tested  is  i , and  let  be  the  optimal 

expected  cost  of  testing  the  system,  if  we  start  the  testing  procedure  by 
checking  component  i first,  i can  be  found  to  be  functioning  or  failing 
and  we  denote  by  C(i)  and  C(i')  the  optimal  costs  of  testing  the  sub- 
trees that  can  be  developed  respectively.  Then  we  have  the  equation: 

(3.14)  ci  - ci  + PjCU)  + qjCd')  . 

We  want  to  show  that:  ^ I + d^  for  every  i ■ 1,2,  ...,  n . By  the 

induction  hypothesis,  we  have: 
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C(i)  > I(i)  = l c - l d (i) 
k*i  * k * 

C(i')  1 I(l')  » I c - l d (i*) 
W1  * k K 


1 c‘ + p{, 


1 ck  " I 

k*i  * k 


']  * 


I ck  - I V1 

k*i  * k * 


*’] 


■ St Ck ' [Pi  l v°  + qi  l dk<1,)] 

* £ c,  - £ d,  (by  the  lemma) 

k k k^i  * 

- I ck  - l \ + di 

k K k K 


I + d 


i * 


Corollary: 

A lower  bound  for  the  expected  cost  of  all  the  testing  procedures  is 

given  by:  I + min  {d  } . 

i 

The  next  theorem  allows  us  to  speed  up  the  calculations  of  the  lower 
bounds  in  each  iteration  of  our  algorithm. 


Theorem  2: 

A lower  bound  for  the  expected  cost  of  testing  the  system — given  that 
we  start  the  testing  procedure  by  checking  component  i , and  then  testing 
components  a or  6 depending  on  whether  xA  • 1 or  xi  ■ 0 respective- 
ly— is  given  by: 

Lt  . 1 ♦ d4  + ptd0(i)  + qids(l')  . 


(3.15) 
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Proof: 


■ I + dl  + + diVl’>  • ■ 

A branch  and  bound  algorithm  seems  to  be  suitable  for  our  problem,  and 
we  use  the  measure  of  unimportance  that  we  defined  in  (3.1)  as  the  decision 
criterion  for  its  operation.  The  algorithm  is  described  in  the  next  section. 
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4.  BRANCH  AND  BOUND  ALGORITHM 

To  establish  the  optimal  testing  procedure  we  need  to  develop  an  < 

optimal  tree  that  will  tell  us  which  component  to  test  first,  and  according 
to  the  result  of  the  first  test,  or  any  other  subsequent  tests  where  to  con- 
tinue in  our  testing  procedure.  The  algorithm  works  by  developing  subtrees, 
such  that  at  each  iteration  the  subtree  on  hand  is  the  one  which  gives  the 
lowest  bound  of  the  type  that  we  defined  earlier. 

We  start  the  algorithm  with  n such  subtrees,  which  are  the  original 

components,  and  pick  the  one  which  minimizes  I + d^  over  all  ' 

i = 1,2,  ...,  n . With  this  component  k , say,  we  continue  by  considering 
2 

the  (n  - 1)  subtrees  which  consist  of  the  component  k branching  to  each 
combination  of  two  out  of  the  (n  - 1)  remaining  components.  For  each  of 
these  subtrees,  which  correspond  to  different  possible  decision  rules,  the 
left-hand  branch  goes  to  the  component  which  is  to  be  tested  if  k is  found 
failed,  and  the  right-hand  branch  goes  to  the  component  which  is  to  be 
tested  if  k is  found  working. 

After  computing  the  bounds  for  each  of  these  new  subtrees,  we  find  the 
minimum  of  all  the  bounds  that  we  have  computed  so  far,  and  continue  to 
expand  the  corresponding  subtree  in  a similar  manner.  This  subtree  may,  at 
this  stage,  be  either  a single  component,  or  a subtree  which  we  have  con- 
structed. 

Eventually,  we  will  find  a subtree  which  is  a complete  tree  (i.e.,  it 
need  not  be  expanded  any  more,  and  thus  it  uniquely  describes  a testing  pro- 
cedure for  the  given  system)  such  that  its  expected  cost  is  less  than  or 
equal  to  the  lower  bound  for  any  other  subtree.  This  will  be  the  optimal 
testing  tree. 


The  algorithm  is  described  schematically  in  Figure  1. 
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FIGURE  1 


^ Nodes  are  Che  lowesc  level  components  in  a subtree. 

Is  the  vector  of  component  states  which  lead  to  node  s^  in 
subtree  i . 
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Example: 


Consider  a 2-out-of-3  system  (a  k-out-of-n  system  works  if  and  only  if 
at  least  k out  of  its  n components  work),  with  the  reliability  function: 


h(P)  = PLP2  + PLP3  + P2P3  - 2p1p2p3 


and  the  following  data: 


i pi  Ci 


1.6  5 


2.8  2 


3.9  4 


Iteration  #0  (Initialization) : 


We  compute  the  Importance  Measures  for  all  the  components: 


1^  = p2  + p3  - 2p2p3  ■ 1.7  - 1.44  ■ 

12  • p^  + P3  - 2p^p3  ■ 1.5  - 1.08  ■ 

13  ■ + p2  - 2p^p2  ” 1.4  - .96  ” 


I « l c.I.  - 3.9  . 


Iteration  #1: 


Compute  the  lower  bounds  as  defined  in  Theorem  1,  for  all  the  given 


componer.es : 


Lx  - I + d1  - I + cx(l  - IL)  - 3.9  + 3.7  - 7.6 

L2  - I + d2  - I + c2(l  - I2)  - 3.9  + 1.16  - 5.06 

L3  - I + d3  - I + c3(l  - I3)  - 3.9  + 2.24  - 6.14  . 
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Since  L 2 = min  {L^}  , we  continue  the  algorithm  by  developing  a sub- 
tree whose  root  is  component  2. 

Iteration  #2: 

Compute  the  lower  bounds,  as  defined  by  (3.15),  for  the  following 
trees : 


First,  we  have  to  compute  d^(2)  and  d^ (2 * ) for  i ■ 1 , 3 , as 
given  by  (3.6)  and  (3.7): 

di (2)  - c^l  - 1 + p3)  - P3cL  = 4.5 
dl(2’)  “ cx(l  - p3)  - - .5 

d3(2)  - c3(l  - 1 + PL)  - PjCj  - 2.4 
d3 (2 ' ) - c3(l  - Pj^)  - qxc3  - 1.6  . 

The  new  set  of  lower  bounds  will  be: 

• Lj  + Pjd^(2)  + q2d1(2')  * 5.06  + 3.7  - 8.76 

L5  - L2  + P2d3(2)  + q2d1(2')  - 5.06  + 2.02  - 7.08 

L6  - L2  + P2d1(2)  + q2d3(2’)  - 5.06  + 3.92  - 8.98 

L?  - L2  + p2d3(2)  + q2d3(2')  - 5.06  + 2.24  - 7.3  . 

Now  we  see  that  L,  ■ min  {L. } , and  we  have  to  develop  all  the  trees 
3 i+2  1 

that  can  be  originated  by  component  3. 
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Iteration  // 3 (Termination)  : 

Compute  the  lower  bounds  for  the  following  trees: 


We  compute  the  new  d^(3)  and  d^(3')  for  1 ■ 1 , 2 : 

^1  (3)  - Cjd  - 1 + p2)  - c1p2  - 4 

<^(3')  - c^l  - p2)  = = 2 

d2(3)  - c2(l  - 1 + px)  - c2P1  = 1.2 
d2(3')  - c2(l  - p^  * c2q1  = .8  . 

The  new  set  of  lower  bounds: 

Lg  - L3  + P3d1(3)  + q3d1(3')  - 6.14  + 3.8  - 9.94 
Lg  - L3  + p3d2(3)  + q3d  (3')  - 6.14  + 1.28  = 7.42 

L10  “ L3  + P3di(3)  + q3d2(3' ^ " 6,14  + 3'68  " 9,82 
L11  " L3  + P3d2(3)  + ^3d2(3,)  * 6,14  + 1,16  " 7,3  * 

Finally,  L.  ■ min  {L  } , and  the  tree  given  in  (5)  is  equiva- 

5 i-1 11 

11*2,3 

lent  to  a complete  tree  for  our  problem.  The  complete  testing  procedure 
which  is  uniquely  determined  by  (5)  is: 
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